High · 7.5 CVE-2026-41032 EUVD-2026-34070GHSA-5hqw-c68q-v3hh

Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers

Published Jun 3, 2026 · Updated Jun 3, 2026 · Assigned by CERTVDE

Vendor: Phoenix Contact Product: CHARX SEC-3000 Product: CHARX SEC-3050 Product: CHARX SEC-3100 Product: CHARX SEC-3150 Category: ICS / OT

Description

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

Affected products

Vendor	Product	Affected	Fixed
Phoenix Contact	CHARX SEC-3150	1.0.0 – < 1.9.0	1.9.0
Phoenix Contact	CHARX SEC-3100	1.0.0 – < 1.9.0	1.9.0
Phoenix Contact	CHARX SEC-3050	1.0.0 – < 1.9.0	1.9.0
Phoenix Contact	CHARX SEC-3000	1.0.0 – < 1.9.0	1.9.0

Advisories 1

VDE-2026-060 Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers CERT@VDE · Jun 3, 2026

References

https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-060.json vendor-advisory
https://certvde.com/de/advisories/VDE-2026-060/ vendor-advisory